17

I recently needed to add some SSL certificates to my Mac (OSX 10.10.5) in order connect to a remote service. The certificates are needed for 2 factor authentication.

I have full Admin rights in OSX. I am able to successfully add the certificates to the Keychain. I can go into the KeyChain app and set the certificate to Always Trust without issue.

When I attempt to make the connection (using Cyberduck for WebDAV in this case), I am asked to choose the proper certificate, and then I get this window:

enter image description here

So I enter my Username and Password, which DOES have full Admin rights. I click Allow and the window pops back up again, asking me for my Username and Password again. It doesn't seem to do anything. No errors or anything like that. Clicking "Deny" obviously tells the system I'm rejecting the certificate and it won't let me connect.

I can go directly into the KeyChain application and unlock and make all the changes I want, using my Username and Password (that has Admin rights). So why is this dialog not accepting my same Username and Password?

UPDATE

When putting in my Username and Password, and clicking "Allow" the system log reports:

Apr 22 10:05:15 my-computer.local Cyberduck[1621]: [background-1] ERROR ch.cyberduck.core.ssl.CertificateStoreX509KeyManager - Keystore not loaded Get Key failed: pad block corrupted
Apr 22 10:05:16 my-computer.local com.apple.SecurityServer[87]: Problem opening rules file "/etc/authorization": No such file or directory

After some investigation, it appears that the /etc/authorization file was removed in Mavericks (OSX 10.9). So what is going on here exactly? Why is it trying to find this file that the OS should know isn't used anymore?

Improve this question
4
  • It sounds like the certificates were not added to the certificate store correctly. Your user obviously does not have permission to the System keychain, my suggestion, added the certificates to the user's keychain.
    – Ramhound
    Apr 22, 2016 at 15:15
  • I do have full access to the System Keychain. I can unlock it and make changes in the Keychain application.
    – Jake Wilson
    Apr 22, 2016 at 15:35
  • You might try looking at the system.log. I had an issue recently where a program was interfering with the Keychain (causing the prompts not to be trusted), and was getting appropriate error messages there.
    – D Schlachter
    Apr 22, 2016 at 15:54
  • The system log I think has some helpful info in it. See updated answer.
    – Jake Wilson
    Apr 22, 2016 at 17:43

2 Answers 2

Reset to default
19

from keychain, select your certification, change access control to "allow all applications to access this item"

enter image description here

Improve this answer
5
  • 4
    Where exactly do you bring up that Window in the Keychain Access application?
    – Jake Wilson
    Apr 27, 2016 at 15:04
  • 1
    To answer Jake Wilson's question: double click on the certificate in the Keychain Access application.
    – BazzPsychoNut
    Aug 1, 2017 at 12:24
  • 1
    Here's an answer with a few more details: superuser.com/a/1306894/280734
    – Jake Toronto
    Mar 22, 2018 at 17:51
  • Wow, first time I ever knew there was this possibility! And it works! Thanks!
    – auspicious99
    Mar 9, 2021 at 17:06
  • 1
    Double-click the associated key – double-clicking the certificate only brings up trust info.
    – Sinjai
    Mar 18, 2021 at 1:33
0

Just some info to hopefully help someone else... I have no answers for why this fixed my problem or why I created the cert way back when...

I had a similar problem... but always with Apple Mail and always with one specific mail account.... it always asked for the System keychain auth...

I fixed it by deleting a self-signed Open Directory certificate I created at some point a long while ago... the cert had the specific mail account id as the email in the cert...

I have no idea why I created the cert - as it was a long time ago... but the problems with the email id started last year when I reset my default keychain.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .